Method and apparatus for providing an adaptable security level in an electronic communication

• US 9,819,686 B2
• Filed: 07/20/2016
• Issued: 11/14/2017
• Est. Priority Date: 07/07/2003
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Certicom Corporation (Blackberry Limited)
• Inventors: Struik, Marinus
• Primary Examiner(s): SCHMIDT, KARI L
• Application Number:
  US15/215,187
• Publication Number:
  US 20160344742A1
• Time in Patent Office: 482 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

A method of communicating in a secure communication system, comprises the steps of assembling a message at a sender, then determining a security level, and including an indication of the security level in a header of the message. The message is then sent to a recipient.

Claims

1. A method for providing security in an electronic communication system, comprising:

receiving a plurality of frames, wherein each individual frame in the plurality of frames has a header and associated data, the header of each individual frame including security control bits that indicate for the individual frame whether encryption has been provided for the individual frame and whether integrity has been provided for the individual frame, wherein the security control bits include one or more security mode bits and integrity level bits, wherein the one or more security mode bits are used to indicate whether encryption is on or off, and wherein the integrity level bits indicate which of at least four integrity levels is utilized, the integrity levels corresponding to signing operations of a sender of increasing strength; and

for each individual frame;

identifying a security level for the individual frame based on the security control bits in the header of the individual frame;

checking said security level against predetermined security requirements; and

rejecting the individual frame in response to said security level not meeting said predetermined security requirements.

2. The method of claim 1, wherein said security level is selected based on said predetermined security requirements.

3. The method of claim 2, wherein said predetermined security requirements are determined based on an agreed-upon rule.

4. The method of claim 1, wherein said security control bits include an indication of a cryptographic algorithm parameter.

5. The method of claim 1, further comprising decrypting each individual frame according to said security level for the individual frame.

6. The method of claim 1, further comprising verifying the integrity of each individual frame according to said security level for the individual frame.

7. The method of claim 1, wherein the number of integrity levels is four, and the four integrity levels correspond to key lengths of 0, 32, 64, and 128 bits.

8. The method of claim 1, wherein one of the integrity levels uses a key length of 128 bits.

9. The method of claim 1, wherein one of the integrity levels indicates no integrity security.

10. The method of claim 1, wherein the number of integrity levels is at least four, and the at least four levels include four levels corresponding to key lengths of 0, 32, 64, and 128 bits.

11. A communication device, comprising:

at least one hardware processor;

a non-transitory computer-readable storage medium coupled to the at least one hardware processor and storing programming instructions for execution by the at least one hardware processor, wherein the programming instructions instruct the at least one hardware processor to;

receive a plurality of frames, wherein each individual frame from the plurality of frames has a header and associated data, the header of each individual frame including security control bits that indicate for the individual frame whether encryption has been provided for the individual frame and whether integrity has been provided for the individual frame, wherein the security control bits include one or more security mode bits and integrity level bits, wherein the one or more security mode bits are used to indicate whether encryption is on or off, and wherein the integrity level bits indicate which of at least four integrity levels is utilized, the integrity levels corresponding to signing operations of a sender of increasing strength; and

for each individual frame;

identify a security level for the individual frame based on the security control bits in the header of the individual frame;

check said security level against predetermined security requirements for said communication device; and

reject the individual frame in response to said security level not meeting said predetermined security requirements.

12. The communication device of claim 11, wherein said security level is selected based on said predetermined security requirements for said communication device.

13. The communication device of claim 12, wherein said predetermined security requirements are determined based on an agreed-upon rule.

14. The communication device of claim 11, wherein said security control bits include an indication of a cryptographic algorithm parameter.

15. The communication device of claim 11, wherein the programming instructions further instruct the at least one hardware processor to decrypt each individual frame according to said security level for the individual frame.

16. The communication device of claim 11, wherein the programming instructions further instruct the at least one hardware processor to verify the integrity of each individual frame according to said security level for the individual frame.

17. The communication device of claim 11, wherein the number of integrity levels is four, and the four integrity levels correspond to key lengths of 0, 32, 64, and 128 bits.

18. The communication device of claim 11, wherein one of the integrity levels uses a key length of 128 bits.

19. The communication device of claim 11, wherein one of the integrity levels indicates no integrity security.

20. The communication device of claim 11, wherein the number of integrity levels is at least four, and the at least four levels include four levels corresponding to key lengths of 0, 32, 64, and 128 bits.